Moved from GitHub dgraph/4721
Posted by Fantastitech:
This was touched on in #3118 but wasn’t well fleshed-out.
Bcrypt being computationally bound has knocked it out of favor for new auth implementations. Scrypt is generally considered a better option as it’s memory bound. However, argon2 is generally accepted as the new industry-standard password hashing algorithm. See: https://medium.com/@mpreziuso/password-hashing-pbkdf2-scrypt-bcrypt-and-argon2-e25aaf41598e
Dgraph’s password type is hard-coded to use Bcrypt, limiting the growth of the feature as new technology emerges.
Because of the password type returning only a bool and the hashes being uniquely tagged with version information this could be a simple non-breaking change and in the process refactor Dgraph’s password type into a more future-proof solution that can have hashing algorithms easily added. Hash type detection, hashing, and verification functions could be added for various hashing algorithms and the current Encrypt and VerifyPassword functions could be modified to detect the algorithm of a hash and the algorithm desired then hash and compare using the appropriate functions.
This is something I’m willing to work on, however a decision would need to be made on how to pass parameters to new hashing algorithms. Argon2id has a standard for determining the best parameters for available resources so to use it effectively it would have to be tuned. Users would also need a way to set the default hashing algorithm to be used.
Is this something that could be implemented in the schema as optional parameters when defining a password type? How should this be approached?